1. Fronting Tomcat with Apache Httpd Mladen Turk Red Hat, Inc.

2. Agenda
Introduction
Using mod_jk
Using mod_proxy

3. Typical architecture Enterprise information systems
Heterogeneous environment
Multiple data sources (static/dynamic)

4. Typical architecture Apache Httpd in front
Requests for dynamic information or interaction with back-end data sources go through web server to app server
mod_jk or mod_proxy
Apache HTTPD
Apache Tomcat JBoss AS Geronimo

5. Enterprise IS problems
Applications are time consuming
Process client data, access the database, do some calculations and present the data back to the client.
Within ½ of second to achieve user perception of a working application
High concurrency
The entire family of your manager will participate in testing
Add more CPU power
Buy faster hardware
Add more boxes
Security
Share applications with Intranet
Use Intranet data

6. Simple configuration Separate content
Web server delivers static content
Application server delivers dynamic content

7. Secure generic configuration
Secure your data
Put the web server in DMZ
Handle security with Web server

8. High availability configuration
Add more application servers
Failover in case of failure
Add more boxes
Handle more clients

9. Apache HTTPD Architecture
Threaded
Windows, Netware
MaxClients
Parent process
Listener Socket
Child process T1 T2 Tn

10. Apache HTTPD Architecture
Prefork
Unixes
StartServers
MaxClients
Parent process
Listener Socket
Child process
Child process
Child process

11. Apache HTTPD Architecture
Semi-threaded (worker)
Unixes (Apache 2 and up)
ThreadsPerChild
MaxClients
Parent process
Listener Socket
Child process T1 T2 Tn
Child process T1 T2 Tn

12. Tomcat Architecture maxThreads AJP Connector HTTP Connector SSL
Server
Service
Engine
Host
Context
Context 1 2 3 4

13. Tomcat architecture Thread context switch latency
Limits the number of concurrent connections
Limit 250 per CPU – (empirical)
Depends on the OS and JVM very bad on Windows (kernel limit on 64 event objects) T1 T2
Processing
Latency

14. Getting the most out of integration
Do you need that?
Additional configuration
Additional maintenance
Need to build the connector on your own
Additional point of failure
Define your needs
Application response time
Number of concurrent users
Network throughput

15. Getting the most out of integration
Define your topology
Application servers
Web servers
Static content delivery
Clustering
Sessions
Caching
Failover
Load balancing

16. Getting the most out of Integration
Separate content
Do not mix application and native web server content
Separate applications
Do not mount /*
Do not mount /*.jsp
Use native SSL
Much faster then JSSE
Can use hardware accelerators

17. Getting the most out of Integration
Do you need SSL between web and application server?
Paranoid IT department
Understand the problem
Encryption is done twice
Tomcat
Apache HTTPD
mod_ssl
NIC 1
NIC 2
NIC 1
Firewall/443
Firewall/8009

18. Fronting with mod_jk Apache Tomcat project
Use current stable (1.2.22)
Supported Apache Httpd servers
Apache 1.33+
Apache
Apache 2.2/2.3 (*)

19. mod_jk architecture Uses AJP 1.3 protocol Integrated load balancer
Binary custom protocol
Constant connection pool
No need to parse HTTP headers twice
All preprocessing is done in Apache httpd
Integrated load balancer
Sticky sessions
Failover
Domain model clustering

20. mod_jk Architecture <Connector … protocol=“AJP/1.3"/>
worker.tomcat.type=ajp13
AJP Protocol
<Connector … protocol=“AJP/1.3"/>
Tomcat
MaxClients ThreadsPerChild maxThreads
AJP protocol is reusable. Mod_jk opens a pool of connections to Tomcat.

21. mod_jk Load balancer Architecture
worker.host1.type=ajp13
AJP13
AJP/1.3
jvmRoute=“host1”
worker.host2.type=ajp13
AJP13
AJP/1.3
jvmRoute=“host2”
worker.balancer.type=lb worker.balancer. balance_workers=host1,host2

22. Using mod_jk Understand configuration httpd.conf server.xml
<IfModule worker.c>
StartServers
MaxClients
MinSpareThreads
MaxSpareThreads
ThreadsPerChild
MaxRequestsPerChild 0
</IfModule>
<Service name=“Catalina”>
<!-- A AJP 1.3 Connector on port >
<Connector port=“8009” address=“ ”
enableLookups="false" redirectPort=“8443” debug=“0“ maxThreads=“150” minSpareThreads=“25”
protocol=“AJP/1.3”/>
<Engine name=“standalone” defaultHost=“localhost”
jvmRoute=“host1”>
workers.properties
worker.host1.type=ajp13
worker.host1.port=8009 worker.host1.host= worker.host1.connection_pool_size=25

23. Clustering with mod_jk
Without sticky sessions
Session replication exists between Tomcat nodes
Sticky sessions
No session replication
Session replication between domains
Force sticky sessions
Domain clustering
Allows buddy replication
Split the nodes into groups
Use with large clusters
Tomcat cluster does only allow session replication to all nodes in the cluster. Once you work with more than 3-4 nodes there is too much overhead and risk in replicating sessions to all nodes.

24. mod_jk with Session replication
No need for session affinity
Requests can be served with any node
Tomcat session replication
node1
mod_jk
worker.cluster.type=lb
Session replication
worker.node1.type=ajp13
worker.node2.type=ajp13
node2

25. mod_jk Sticky sessions
Session affinity mark
JSESSIOND defined as part of spec.
<Engine name="jboss.web" defaultHost="localhost"
jvmRoute="node1">
node1
JSESSIONID=XXX.node1
mod_jk
worker.cluster.type=lb
Session replication
worker.node1.type=ajp13
worker.node2.type=ajp13
node2

26. mod_jk Domain clustering
Large number of nodes
<Engine name=“Standalone" defaultHost="localhost"
jvmRoute="domain1">
node1
node2
JSESSIONID=XXX.domain1
mod_jk
worker.cluster.type=lb
worker.domain1.type=ajp13
node3
node4
worker.domain2.type=ajp13

27. mod_jk Hot standby In case of failure
Takes the load only if all other nodes fail
node1
mod_jk
worker.cluster.type=lb
worker.node1.type=ajp13
worker.node2.disabled=True
worker.node2.type=ajp13
node2

28. Handle high concurrency
Use connectionTimeout in AJP/1.3 connector
Actually this is KeepAlive timeout
Closes inactive connections
Firewalls not passing FIN packets
Multiple Apache Httpd front ends
Use connect_timeout
Sends small packet to check the Tomcats availability to serve requests
Can be replaced with socket_timeout
Use prepost_timeout
Needed with connectionTimeout set
Detects closed connections by Tomcat

29. mod_jk Dynamic Configuration
Web based management
Allows dynamic management
VirtualHost limited
workers.properties
worker.list=jkstatus,...
...
worker.jkstatus.type=status
httpd.conf
<Location /jkstatus/>
JkMount jkstatus
Order deny,allow
Deny from all
Allow from
</Location>

30. Using mod_proxy Part of standard Apache httpd distribution
No need to build additional module
Better integration with other modules (mod_rewrite)
Only way to have SSL communication with Tomcat
Using mod_ssl
Requires custom filter in Tomcat to get the original certificates
Requires additional headers for original client certificates
Uses http protocol
Standard protocol
No connection problems

31. mod_proxy for Apache Httpd 2.2
Rewritten mod_proxy
Connection pool capabilities
Option to separate MaxThreadsPerChild and connection pool size
More protocol
AJP 1.3 protocol support
mod_proxy_ajp
Integrated load balancer
mod_proxy_balancer
Protocol independent
Session affinity support
Multiple strategies

32. mod_proxy Architecture
Shared memory runtime data
Each child is aware of the connection status
Parent process
Listener Socket
Child process
Scoreboard
Worker #1
Worker #1
status
elected
read
transferred …
Worker #2
Worker #n
On the picture you can see the internal mod_proxy architecture. All runtime data is held inside the httpd’s scoreboard or shared memory. This enables to dynamically manage the workers and to collect the runtime data from all the child process.
This fixes the common problem with previous mod_proxy causing constant connection delays if the connection to the remote can not be established or is broken. With shared memory the first connection to the remote that fails, will update the worker’s status flag in the shared memory. The consecutive requests on different child processes will in that case skip the useless connection attempts on a already dead node.
Child process
Worker #2
Worker #1
Worker #n
Worker #2
Worker #n

33. mod_proxy Load balancing
Virtual proxy
Like any other protocol but prefixed as balancer://
Contains 1 … n protocol workers
LoadModule balancer_module modules/mod_proxy_balancer.so
<Proxy balancer://cluster>
BalancerMember …
</Proxy>
ProxyPass /examples balancer://cluster/examples

34. Why Apache Httpd with Tomcat?
Pros
Can serve static content faster compared to standalone Tomcat.
Supports PHP, CGI etc via modules in addition to the ability to route JSP/Servlet requests to tomcat.
Can load balance requests between multiple instances of tomcat. Also provide session stickiness.
Cons
Needs additional effort to setup.
Dynamic Content (JSP/Servlets) in a heavy traffic scenario may be a bottleneck, due to the tunnelling that happens between apache and tomcat.
Native code tightly coupled to the operating system.

35. Links Apache Httpd Tomcat Mod_jk Support Google
Tomcat
Mod_jk
Support
Apache Httpd mailing lists
Tomcat users mailing list
Google

36. Q & A

37. Fronting Tomcat with Apache Httpd was presented to you by
Mladen Turk
Fronting Tomcat with Apache Httpd was presented to you by